API and HTTP Security Questions

Security considerations for application programming interfaces and the Hypertext Transfer Protocol surface. Topics include configuring and validating Transport Layer Security, common HTTP security response headers such as Content Security Policy, X Frame Options, and Strict Transport Security, secure token handling and storage, Open Authorization scopes and patterns, JavaScript Object Notation Web Token usage and pitfalls, API key management and rotation, request validation and schema enforcement, cross origin controls, design of rate limiting and throttling mechanisms to prevent abuse, gateway and edge protections, secure error handling, and logging for audit and detection. Candidates should be able to discuss both defensive controls and how to implement them in client and server code.